The current approaches to provide a secure voting system on a wide area or local area network have traditionally emphasized purely cryptographic-protocol-based solutions to secure the voting. The work done to date is largely purely research into specific issues in secure electronic voting and does not address the practical application into a real-world system.
The prior art has approached worldwide area network, for example, on the global computer network known as the Internet, elections as an extension of secure, electronic commerce techniques without providing a comprehensive approach to the significant threats, vulnerabilities and risks that threaten the security, authenticity and reliability of such elections.
Internet elections must achieve the objectives of conventional elections, specifically: “democracy” (only registered citizens may vote once in any election), accuracy (votes may not be altered, forged or deleted), “privacy” (no one may know how anyone else voted or prove how they voted), and “verifiability” (everyone should be able to verify their own ballot, as well as the correctness of the entire election). Moreover, Internet elections address additional capabilities: “mobility” (individuals should be able to vote from any Internet-accessible location, at any legal time), “convenience” (voting should be simple and convenient for everyone), and “flexibility” (the technology should be applicable to all elections).
Internet voting systems must achieve these objectives in the face of both conventional election threats, and threats specific to automated, distributed computer systems, including: fraud, abuse of privilege (privileged individuals may act inappropriately), denial of service (computer services may be impaired or rendered inaccessible), software flaws, tampering (of recorded ballots or other data), malicious software, wiretapping (sniffing, modification or replay of communications), vote selling, or masquerading (by client/server computers or by people).
The prior art has taken several approaches towards Internet election systems. Electronic commerce or E-Commerce approaches rely on securing communications through encrypted connections and verifying individual identity only through weak or single-factor authentication (e.g., passwords). Encrypted Absentee Balloting systems emulate conventional absentee balloting by using ballots that are doubly encrypted using symmetric keys. Cryptographic protocols, particularly those relying on asymmetric or public-key cryptography hold the greatest promise but have been relegated largely to the academic community.
All these techniques have characteristic weaknesses. E-Commerce techniques secure only voter-system communications. They provide weak authentication and no (strong) mechanisms for achieving democracy, privacy, accuracy or verifiability. Encrypted Absentee Ballot systems provide better privacy, but provide no stronger mechanisms for democracy, accuracy or verifiability, and are vulnerable to abuse of privilege, potentially compromising the keys used to ensure privacy. Many of the cryptographic protocols developed to date are complex, making implementation verification difficult. Public-key cryptography and digital signature techniques promise strong authentication, accuracy and verifiability. However, the generation and distribution of public-private (secret) key-pairs, and the protection of private keys, makes these techniques difficult to apply to large-scale applications such as Internet voting.
Specifically, it has been recognized that existing private-key management techniques, i.e., PKI approaches, are not acceptable if they require the end users to buy, install or configure anything, or require any particular type of client device. Such considerations become particularly significant when there may be huge numbers of end users, for example, 100,000 to 1,000,000, such as may be the case in an election.
It is recognized that PKI technology supports the use of public-key cryptography by providing various means to generate public-private (secret) key pairs, protect access to the private (secret) key so that it can be used only by the individual with whose identity it is associated, and provide for distribution and convenient access to the public key. Common strategy involves generation of public/secret key pairs on a user's personal computer by an application such as a web browser, storage of the private key within a personal identification number (PIN) protected, encrypted key-store file on the user's personal computer (PC), and exportation of the public key to a certificate authority, for example, where it is wrapped in a digital certificate, such as an X.509 digital certificate, and made available for public access on a lightweight directory access protocol (LDAP) certificate directory service.
This approach has advantages in that it is convenient and the private keys never leave the user's PC. Disadvantages result, however, because even though the private keys are protected in PIN-based encrypted files, PCs offer little protection against key-store cryptoanalysis by malicious software, and user mobility is impaired as it requires effort to export a private key so that it can be used on another platform.
An alternative strategy involves generation of public/secret key pairs on a secure platform rather than the user's PC, for example, a server. Yet still further, the approach involves storage of the private key, and perhaps other authentication-related data, on a storage device such as a password-encrypted floppy disk, or on a password-protected token/dongle, Java-ring (iButton) or smart card devices, as well as exportation of public keys and digital certificates as described with respect to the first approach.
One advantage of this approach is that the private key is more easily accessed from various computers, facilitating mobility, so long as there is a hardware interface for the private-key device. In addition, the private key is better protected within a removable device. Resultant disadvantages include the fact that the server must be verified not to make/leave copies of the private key. In addition, there must be some sort of hardware interface to allow retrieval of the key from the storage device, e.g., disk drive, USB port, iButton/smart card reader, etc. Yet still further, these hardware interfaces may be expensive, difficult to install/configure, and may not be universally available, thus inhibiting mobility.
The advantages and disadvantages of the above-identified two approaches have led to a third approach. In the third approach, generation of public/secret key pairs is done on a secure platform other than the user's PC, for example, a server. The secret keys are stored in encrypted form on the secure server and downloaded to the client over a secure network connection as needed to support authentication, digital signature or encryption operations. The server must authenticate the user by some non-PKI-based method before allowing the user to download their private key. In most cases, this will still require some authentication device.
While providing further refinements and including advantages such as convenience and mobility being improved because private keys are always available from a network server, and no hardware interfaces are required on the client device, significant disadvantages still remain.
Initially, it is noted that there is a need for a secondary strong authentication technique that requires hardware token support, e.g., SecureID. In addition, such hardware tokens incur additional expense, and private keys are stored on a secure server using one or more keys known to the server, thus requiring the server to protect access to and use of these keys.
In all three approaches described, retrieval of private keys from local/network storage is required for use within the memory of a PC or thin-client device, and exposes the key to potential compromise. Only tokens with processors can perform the necessary cryptographic operations without exposing the private key. None of the approaches offer sufficient security, mobility and convenience at a sufficiently low cost to make public/private key cryptographic services, e.g., authentication, non-repudiation, encryption, attractive for applications with a potentially large number of users such as in the case of an election with users numbering from anywhere between 100,000 to about 10,000,000.
In order to make public/private key cryptographic services feasible for such applications, there must be a low-cost way to generate public/secret keys, while providing secure storage for and access to those keys without requiring special hardware or inconvenient procedures. These advantages and other advantages are provided by the system and method described herein, and numerous disadvantages of existing techniques are avoided.